Privacy Policy

Last updated: June 2026

Information We Collect

We collect event information from publicly available sources to help users discover bluegrass concerts. For bands, venues, festivals, and concert series who register accounts, we collect:

Email address and account credentials
Band name and website URL (for bands)
Venue name, address, and contact information (for venues)
Festival name, location, dates, and organizer details (for festivals)
Concert series name, schedule, and venue information (for concert series)
Event information automatically collected from band websites
Manual event details you submit (venue, location, date, time)
Community jam details you submit (venue, schedule, recurrence pattern)
Venue profile information (description, images, social media links)
Profile images uploaded by bands (stored securely in the cloud)
Newsletter subscription preferences (location and frequency)
Your device location (only when you enable distance-based sorting)
Event edit suggestions and reports you submit (issue type, description, optional email)
Trending event reactions (anonymous, not linked to your identity)
Search history (stored locally in your browser only, not on our servers)

How We Use Information

Event data is displayed on our map and events list to help fans find shows
Band account information is used to manage your profile and automatically check your website for events
Venue account information is used to manage your venue profile and allow you to add events directly
Festival account information is used to manage your festival listing and event schedule
Concert series account information is used to manage recurring event series
Email addresses are used for account verification, password resets, approval notifications, magic login links, and optional newsletters
Newsletter subscriptions send you weekly or monthly event digests for your selected locations
Subscription tier information determines access to premium features (unlimited manual events, analytics, enhanced visibility, venue contact info, matched bands in Where to Play, and Request to Book for venues)
Community jam submissions are reviewed by our team and displayed on the map when approved
Event edit suggestions are used to improve event accuracy and are reviewed by our team
Trending reactions are used anonymously to surface popular events
Location data is used only to calculate distances to events when you enable distance sorting (not stored or shared)
We do not sell or share your personal information with third parties

Data Storage

Your data is securely stored on AWS servers in the US-East-1 region. Band profiles, venue profiles, festival profiles, concert series data, event data, and subscription preferences are stored in DynamoDB databases with appropriate security measures. Profile images (band photos and venue images) are stored in S3 with CloudFront CDN delivery. All data is encrypted in transit and at rest.

Payment Processing

Premium subscriptions for bands, venues, and festivals are processed through Stripe, a third-party payment processor. When you upgrade to Premium, Stripe collects your payment information directly. We do not store your credit card details on our servers. Stripe's use of your data is governed by their privacy policy. We receive only your subscription status, customer ID, and transaction metadata from Stripe.

Analytics & Insights (Premium Feature)

We collect anonymous interaction data on events to power features like trending events and to provide premium accounts with performance insights. This includes:

Event views (when someone views your event details)
Ticket button clicks (when someone clicks to purchase tickets)
Social media clicks (when someone clicks your social media links)
Map interactions (when someone views your event on the map)
Trending reactions (when someone reacts to a trending event)
Geographic data (state-level only, no precise locations)
All analytics data is anonymous and cannot be linked to individual users
Analytics data is automatically deleted after 90 days
No cookies or personal identifiers are used for analytics tracking
Aggregated data powers the trending events feature visible to all users
Detailed analytics dashboards are available only to premium bands, venues, and festivals

Cookies and Tracking

We use localStorage to maintain your login session, store authentication tokens, and save your search history locally in your browser. Search history is never transmitted to our servers.

We use Google Analytics to understand how people use GrassGigs so we can improve it. Google Analytics is only loaded after you provide consent via our cookie banner. If you decline, no Google Analytics scripts are loaded and no tracking occurs. You can change your preference at any time by clearing your browser's localStorage (key: cookie_consent) and reloading the page.

Google Analytics may collect information about your device, browser, and usage patterns when you consent to it. You can also opt out by installing the Google Analytics Opt-out Browser Add-on.

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), UK, or other jurisdictions with similar data protection laws, we process your personal data under the following legal bases:

Contract performance: Processing your account data, managing subscriptions, and providing the services you signed up for (e.g., event scraping, profile management, newsletters you subscribe to)
Consent: Google Analytics tracking (via our cookie consent banner), newsletter subscriptions (via double opt-in email verification)
Legitimate interest: Displaying publicly scraped event data, rate limiting to prevent abuse, basic service security and fraud prevention

You may withdraw consent at any time. Withdrawing consent for analytics is done by declining cookies or clearing your cookie preference. Withdrawing consent for newsletters is done by clicking the unsubscribe link in any email.

International Data Transfers

Your data is stored on AWS servers in the United States (US-East-1 region). If you are located outside the US, your data is transferred to the US for processing. AWS maintains compliance with applicable data protection frameworks including EU Standard Contractual Clauses (SCCs) for international transfers. For more information, see AWS GDPR Center.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access and update: You can view and update your band, venue, or festival information anytime through your dashboard
Data portability: You can download a copy of all your personal data directly from your dashboard using the "Download My Data" button. The export is provided in a structured, machine-readable format (JSON). You can also request a copy by emailing support@grassgigs.com and we will respond within 30 days
Deletion (right to erasure): You can delete your account and all associated data directly from your dashboard using the "Delete Account" option. This removes your data from our authentication system, all database tables, and cloud storage. You can also request deletion by emailing us
Withdraw consent: You can withdraw consent for analytics tracking by declining cookies, and for newsletters by clicking unsubscribe in any email
Restriction and objection: You can request we restrict processing or object to processing by contacting us at support@grassgigs.com
Lodge a complaint: If you are in the EEA, you have the right to lodge a complaint with your local data protection authority

To exercise any of these rights, contact us at support@grassgigs.com. We will respond within 30 days.

Data Retention

Account data: Retained until you delete your account
Analytics data: Automatically deleted after 90 days (via TTL)
Email verification codes: Expire after 24 hours
Newsletter subscriptions: Retained until you unsubscribe
Event data: Past events are cleaned up automatically during scraping cycles

Contact Us

For questions about this privacy policy, contact us at support@grassgigs.com